Executive brief
Parse Server is a popular backend-as-a-service framework used to build application servers and APIs. An attacker can exploit a prototype pollution vulnerability in the MongoDB BSON parser to achieve remote code execution without authentication, potentially allowing complete compromise of servers running vulnerable versions. This could lead to theft of application data, service outages, and lateral movement within an infrastructure.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in Parse Server's MongoDB database adapter that affects how BSON objects are parsed. An unauthenticated attacker on the network can craft malicious input to the BSON parser that pollutes the JavaScript prototype chain, leading to arbitrary code execution with no prerequisites. The attack requires no user interaction and affects all versions prior to 4.10.18 and 5.0.0–5.3.0. Patches are available in Parse Server 4.10.18 and 5.3.1 and later.
Affected products
- Parse Community Parse Server <4.10.18, >=5.0.0 <5.3.1
Timeline
- 2022-11-08: disclosed: GHSA-prm5-8g2m-24gg published
- 2022-11-08: patched: Parse Server 4.10.18 and 5.3.1 released